删除和恢复 Azure Log Analytics 工作区Delete and recover Azure Log Analytics workspace

本文介绍了 Azure Log Analytics 工作区软删除的概念,以及如何恢复已删除的工作区。This article explains the concept of Azure Log Analytics workspace soft-delete and how to recover deleted workspace.

删除工作区时的注意事项Considerations when deleting a workspace

删除 Log Analytics 工作区时,将执行软删除操作,在 14 天内允许恢复工作区(包括其数据和连接的代理),无论是意外删除还是有意删除。When you delete a Log Analytics workspace, a soft-delete operation is performed to allow the recovery of the workspace including its data and connected agents within 14 days, whether the deletion was accidental or intentional. 软删除期过后,工作区资源及其数据将不可恢复 - 其数据会排队等待永久删除,并在 30 天内完全清除。After the soft-delete period, the workspace resource and its data are non-recoverable - its data is queued for permanent deletion and completely purged within 30 days. 工作区名称为“已发布”,你可以使用它来创建新的工作区。The workspace name is 'released' and you can use it to create a new workspace.

删除工作区时需谨慎,因为其中可能会含有对服务操作产生不利影响的重要数据和配置。You want to exercise caution when you delete a workspace because there might be important data and configuration that may negatively impact your service operation. 请了解那些将数据存储在 Log Analytics 中的代理、解决方案以及其他 Azure 服务,例如:Review what agents, solutions and other Azure services store their data in Log Analytics, such as:

  • 管理解决方案Management solutions
  • Azure 自动化Azure Automation
  • 在 Windows 和 Linux 虚拟机上运行的代理Agents running on Windows and Linux virtual machines
  • 在环境中于 Windows 和 Linux 计算机上运行的代理Agents running on Windows and Linux computers in your environment
  • System Center Operations ManagerSystem Center Operations Manager

软删除操作会删除工作区资源,并且任何关联用户的权限都将中断。The soft-delete operation deletes the workspace resource and any associated users' permission is broken. 如果这些用户与其他工作区关联,他们可以继续通过其他工作区使用 Log Analytics。If users are associated with other workspaces, then they can continue using Log Analytics with those other workspaces.

软删除行为Soft-delete behavior

工作区删除操作会删除工作区资源管理器资源,但其配置和数据将保留 14 天,同时会显示工作区已删除。The workspace delete operation removes the workspace Resource Manager resource, but its configuration and data are kept for 14 days, while giving the appearance that the workspace is deleted. 在软删除期间,被配置为向工作区报告的任何代理和 System Center Operations Manager 管理组继续处于孤立状态。Any agents and System Center Operations Manager management groups configured to report to the workspace remain in an orphaned state during the soft-delete period. 该服务还提供用于恢复已删除工作区(包括其数据和已连接的资源)的机制,从实质上撤消删除。The service further provides a mechanism for recovering the deleted workspace including its data and connected resources, essentially undoing the deletion.

备注

已安装的解决方案和链接服务(例如 Azure 自动化帐户)在删除时将从工作区中永久删除,并且无法恢复。Installed solutions and linked services like your Azure Automation account are permanently removed from the workspace at deletion time and can't be recovered. 应在恢复操作后进行重新配置,使工作区恢复到其以前配置的状态。These should be reconfigured after the recovery operation to bring the workspace to its previously configured state.

可以使用 PowerShellREST APIAzure 门户删除工作区。You can delete a workspace using PowerShell, REST API, or in the Azure portal.

Azure 门户Azure portal

  1. 登录 Azure 门户Sign in to the Azure portal.

  2. 在 Azure 门户中,选择“所有服务”。In the Azure portal, select All services. 在资源列表中,键入“Log Analytics”。In the list of resources, type Log Analytics. 开始键入时,会根据输入筛选该列表。As you begin typing, the list filters based on your input. 选择“Log Analytics 工作区”。Select Log Analytics workspaces.

  3. 在 Log Analytics 工作区的列表中,选择一个工作区,然后从中间窗格的顶端单击“删除”。In the list of Log Analytics workspaces, select a workspace and then click Delete from the top of the middle pane.

  4. 确认页面随即出现,显示过去一周内工作区的数据引入。A confirmation page appears that shows the data ingestion to the workspace over the past week. 键入要确认的工作区的名称,然后单击“删除”。Type in the name of the workspace to confirm and then click Delete.

    确认删除工作区

PowerShellPowerShell

PS C:\>Remove-AzOperationalInsightsWorkspace -ResourceGroupName "resource-group-name" -Name "workspace-name"

恢复工作区Recover workspace

当意外或有意删除 Log Analytics 工作区时,该服务会将工作区置于软删除状态,从而使其无法被任何操作访问。When you delete a Log Analytics workspace accidentally or intentionally, the service places the workspace in a soft-delete state making it inaccessible to any operation. 已删除工作区的名称将在软删除期间保留,并且不能用于创建新工作区。The name of the deleted workspace is preserved during the soft-delete period and can't be used for creating a new workspace. 软删除期之后,工作区将不可恢复,会计划将其永久删除,并且发布的名称可用于创建新工作区。After the soft-delete period, the workspace is non-recoverable, it is scheduled for permanent deletion and its name it released and can be used for creating a new workspace.

你可以在软删除期间恢复工作区,包括其数据、配置和已连接的代理。You can recover your workspace during the soft-delete period including its data, configuration and connected agents. 在执行软删除操作之前,你需要对工作区所在的订阅和资源组具有“参与者”权限。You need to have Contributor permissions to the subscription and resource group where the workspace was located before the soft-delete operation. 工作区恢复通过创建包含已删除工作区的详细信息的 Log Analytics 工作区来执行,其中包括:The workspace recover is performed by creating a Log Analytics workspace with the details of the deleted workspace including:

  • 订阅 IDSubscription ID
  • 资源组名称Resource Group name
  • 工作区名称Workspace name
  • 区域Region

Azure 门户Azure portal

  1. 登录 Azure 门户Sign in to the Azure portal.

  2. 在 Azure 门户中,选择“所有服务”。In the Azure portal, select All services. 在资源列表中,键入“Log Analytics”。In the list of resources, type Log Analytics. 开始键入时,会根据输入筛选该列表。As you begin typing, the list filters based on your input. 选择“Log Analytics 工作区”。Select Log Analytics workspaces. 你将看到所选范围内的工作区列表。You see the list of workspaces you have in the selected scope.

  3. 单击左上侧菜单中的“恢复”,打开包含处于软删除状态且可恢复的工作区页面。Click Recover on the top left menu to open a page with workspaces in soft-delete state that can be recovered.

    恢复工作区

  4. 选择工作区,然后单击“恢复”以恢复该工作区。Select the workspace and click Recover to recover that workspace.

    恢复工作区

PowerShellPowerShell

PS C:\>Select-AzSubscription "subscription-name-the-workspace-was-in"
PS C:\>New-AzOperationalInsightsWorkspace -ResourceGroupName "resource-group-name-the-workspace-was-in" -Name "deleted-workspace-name" -Location "region-name-the-workspace-was-in"

恢复操作完成后,将恢复工作区及其所有数据。The workspace and all its data are brought back after the recovery operation. 解决方案和链接服务在删除时已从工作区中永久删除,应进行重新配置,使工作区恢复到其以前配置的状态。Solutions and linked services were permanently removed from the workspace when it was deleted and these should be reconfigured to bring the workspace to its previously configured state. 工作区恢复之后,在重新安装关联的解决方案并将其架构添加到工作区之前,某些数据可能无法进行查询。Some of the data may not be available for query after the workspace recovery until the associated solutions are re-installed and their schemas are added to the workspace.

备注

  • 在软删除期间重新创建一个工作区,会显示此工作区名称已在使用中。Re-creating a workspace during the soft-delete period gives an indication that this workspace name is already in use.

疑难解答Troubleshooting

必须至少拥有“Log Analytics 参与者”权限才能删除工作区。You must have at least Log Analytics Contributor permissions to delete a workspace.

  • 如果不确定删除的工作区是否处于软删除状态且可以恢复,请在“Log Analytics 工作区”页中单击恢复,以查看每个订阅的软删除工作区列表。If you aren't sure if deleted workspace is in soft-delete state and can be recovered, click Recover in Log Analytics workspaces page to see a list of soft-deleted workspaces per subscription. 永久删除的工作区不会包括在该列表中。Permanently deleted workspaces aren't included in the list.
  • 如果在创建工作区时收到一条错误消息“此工作区名称已在使用中”或“发生冲突”,则可能是由于以下原因 :If you get an error message This workspace name is already in use or conflict when creating a workspace, it could be since:
    • 工作区名称不可用,并且已被组织中的某个用户或其他客户使用。The workspace name isn't available and being used by someone in your organization, or by other customer.
    • 该工作区是在最近 14 天内删除的,其名称仍处于软删除期间保留状态。The workspace was deleted in the last 14 days and its name kept reserved for the soft-delete period.